How to form alerting on AIOps

RobertShawver — Wed, 08 Mar 2023 17:38:57 GMT

Hello -

One of the reasons I am taking a look at AIOps (free) is for alerting, but it doesn't seem to correlate from firewalls to AIOps. For example: I would like email alerts for this sort of thing. I currently have, on Panorama > Collector Groups > Collector Log Forwarding > System the following filter to email me ((eventid eq 'config-not-synch') and (description contains 'configuration not synchronized')) and that works great. Now how do I equate that to AIOps?

device_name: MyFirewall
vsys_id: 0
vsys:
eventid: config-not-synch
object:
fmt: 0
id: 0
module: general
severity: high
opaque: HA Group 1: Commit on local device with running configuration not synchronized; synchronize manually
dg_id: 0
tpl_id: 0

In AIOps I have this set:

Settings > Alert Notification Rules >

Rule Name: Warning Config Sync

Rule Conditions: Alert name equals Config Sync

But that doesn't seem to be triggered???

Re: How to form alerting on AIOps

ebenny — Mon, 13 Mar 2023 19:53:09 GMT

Hello @RobertShawver ,

I saw your post and have a few recommendations for you. You may want to look at initially,

This document may help in resolving the issue

https://docs.paloaltonetworks.com/aiops/aiops-for-ngfw/alerts-toc/alerts-reference

Thanks and Regards,

Edison K Benny
Product Specialist
Palo Alto Networks

topic How to form alerting on AIOps in AIOps for NGFW Discussions

How to form alerting on AIOps

Re: How to form alerting on AIOps